kexec on arm fails, possibly due to memdup_user

[Amr Bekhit]

I'm trying to get kexec working on my Qualcom IPQ4019-based ARM
system. My system is built using yocto mickledore, but I'm using the
kernel from openwrt, so that's 5.15.110 (config:
https://pastebin.com/KgP2sJLf). I've compiled in kexec support in the
kernel and included the kexec tools. I'm then trying to load and
execute a zImage, but the load fails. I've added some debug messages
to the kexec_load function in the kernel to try and figure out where
it's failing (see https://pastebin.com/G6AEKakw). Here is the output
of the kexec commands, with the kernel debug messages interdispersed:

~ # kexec --version
kexec-tools 2.0.26
~ # kexec -d -l /data/zImage
Try gzip decompression.
Try LZMA decompression.
lzma_decompress_file: read on /data/zImage of 65536 bytes failed
kernel: 0xb6bea090 kernel_size: 0x324f00
MEMORY RANGES
0000000080000000-0000000087dfffff (0)
0000000088000000-000000009fffffff (0)
zImage header: 0x016f2818 0x00000000 0x00324f00
zImage size 0x324f00, file size 0x324f00
  offset 0x00004a08 tag 0x5a534c4b size 24
zImage requires 0x00335f00 bytes
Decompressed kernel sizes:
 text+data 0x00b90b00 bss 0x0003b8bc total 0x00bcc3bc
Resulting kernel space: 0x00ec6a00
Kernel: address=0x80008000 size=0x00ec6a00
DT    : address=0x80ed0000 size=0x00007c0d
kexec_load: entry = 0x80008000 flags = 0x280000
[   36.388603] __do_sys_kexec_load kexec_load_check: 0
nr_segments = 2
segment[0].buf   = 0xb6bea090
segment[0].bufsz = 0x324f00
segment[0].mem   = 0x80008000
segment[0].memsz = 0x325000
segment[1].buf   = 0xb6be20b0
segment[1].bufsz = 0x7c0d
segment[1].mem   = 0x80ed0000
[   36.432305] __do_sys_kexec_load calling memdup_user...

[   36.459002] __do_sys_kexec_load do_kexec_load: -22
kexec_load failed: Invalid argument
entry       = 0x80008000 flags = 0x280000
nr_segments = 2
segment[0].buf   = 0xb6bea090
segment[0].bufsz = 0x324f00
segment[0].mem   = 0x80008000
segment[0].memsz = 0x325000
segment[1].buf   = 0xb6be20b0
segment[1].bufsz = 0x7c0d
segment[1].mem   = 0x80ed0000
segment[1].memsz = 0x8000

It appears that execution reaches the call to memdup_user, but then
something seems to go amiss there as neither the debug message
indicating an error in memdup_user nor the debug message before
do_kexec_load are called for some reason. I've verified that the
zImage I'm trying to load boots fine in U-boot.

Any thoughts would be appreciated.